Securing the Energy Grid from Cyber Threats with Xage Security
Mar 27, 2025
auto_awesome
Roman Arutyunov, Co-founder and SVP of Products at Xage Security, dives into the pressing cybersecurity threats facing our energy systems. He discusses the vulnerabilities in aging infrastructure and the rise of ransomware and nation-state attacks. The conversation highlights the challenges of merging operational technology with information technology, emphasizing a Zero Trust security approach. Arutyunov shares insights on how AI is reshaping threats and defenses, including the sophistication of phishing attacks and the essential need for robust protective measures.
The energy sector faces heightened cyber threats, with over 60 daily attacks revealing vulnerabilities in legacy systems and necessitating stronger security measures.
Implementing a Zero Trust security approach is crucial, emphasizing strict verification of access in both operational technology and information technology to mitigate risks.
Deep dives
The Rise of Cyber Threats to Critical Infrastructure
Cybersecurity threats to critical infrastructure, particularly within the energy sector, have significantly increased, with over 60 attacks occurring daily. Initially, energy companies underestimated the risk of cyberattacks, believing that hackers wouldn’t target utilities. However, this mindset has changed drastically in recent years, as malicious actors increasingly use ransomware for financial gain and nation-state attacks for espionage or sabotage. This shift highlights a growing awareness of the vulnerabilities that exist in legacy energy systems, emphasizing the need for robust cybersecurity measures.
Operational Technology vs. Information Technology
The distinction between operational technology (OT) and information technology (IT) is critical when discussing cybersecurity in the energy sector. OT includes legacy systems such as sensors and control systems crucial for monitoring and managing energy infrastructure, often lacking modern security practices. In contrast, IT focuses on information systems and data security, typically utilizing more contemporary security protocols. As digital transformation bridges the gap between OT and IT, organizations face significant challenges in securing both types of systems effectively, particularly when they are interconnected.
Zero Trust Security as a Solution
Implementing zero trust security principles is becoming essential for protecting critical infrastructure against cyber threats. This approach entails strict verification of every access request to OT and IT systems, rather than assuming trust simply based on physical presence. Organizations must focus on controlling access tightly, ensuring that users or applications can only interact with necessary assets, thereby reducing the attack surface. As cyber threats evolve, this strategy helps address security gaps introduced by the increasing interconnectivity of energy systems.
Impact of Distributed Energy Resources on Cybersecurity
The transition from centralized power systems to more distributed energy resources, such as renewable energy sources, alters the landscape of cybersecurity challenges. Utilities now rely on numerous external operators for power generation, increasing the complexity of maintaining cybersecurity standards. This decentralization can create vulnerabilities that malicious actors may exploit, making it imperative to implement rigorous security measures across all assets involved in the energy supply chain. As regulatory requirements evolve to encompass renewable energy assets, striking a balance between safety, security, and growth becomes crucial for the industry's future.
Roman Arutyunov is the Co-founder and SVP of Products at Xage Security, a Series B startup focused on protecting critical infrastructure—including energy systems—from cyber threats. Xage is backed by investors like Chevron Technology Ventures, Aramco, Piva Capital, Valor Equity Partners, and Overture.
Cybersecurity is a growing concern as our energy systems become more distributed, electrified, and digitally connected. We spoke with Roman about the vulnerabilities in today’s infrastructure, the motivations behind cyberattacks, and how the rise of AI is changing the cybersecurity landscape.
In this episode, we cover:
[2:11] Introduction to Xage Security
[3:12] Cybersecurity 101: Ransomware, nation-state threats, and attacker motivations
[7:10] Operational tech (OT) vs. information tech (IT)
[13:29] Xage’s Zero Trust security approach
[15:45] Customer segments and differing security challenges
[20:47] Navigating regulations vs. fast deployment timelines
[23:40] How AI is shaping both threats and defenses
[28:00] When multifactor authentication becomes a vulnerability
[31:59] Real-world cyberattacks on energy systems
[34:10] Xage’s funding history and growth trajectory
Episode recorded on Feb 20, 2025 (Published on Mar 26, 2025)
Enjoyed this episode? Please leave us a review! Share feedback or suggest future topics and guests at info@mcj.vc.